fix(gateway): honor dangerouslyDisableDeviceAuth regardless of sharedAuthOk

JasonOA888 · JasonOA888 · commit f67e2eb03898 · 2026-03-13T08:42:45.000+08:00
Fixes #44485 ## Problem After upgrading from 2026.3.8 to 2026.3.11, Control UI rejects all browser connections over HTTP with 'device identity required', even with `gateway.controlUi.dangerouslyDisableDeviceAuth: true`. ## Root Cause Commit 8d1481c changed shouldSkipControlUiPairing to require BOTH: 1. dangerouslyDisableDeviceAuth: true 2. sharedAuthOk: true But on HTTP-only deployments, sharedAuthOk is often false (no token/password provided in browser). This defeats the purpose of the flag. ## Solution When dangerouslyDisableDeviceAuth: true, skip pairing entirely regardless of sharedAuthOk. This restores the 2026.3.8 behavior. ## Changes - src/gateway/server/ws-connection/connect-policy.ts - src/gateway/server/ws-connection/connect-policy.test.ts ## Testing - [x] Unit test updated to reflect new behavior - [x] bypass + sharedAuthOk=false now returns true - [x] HTTP-only deployments can use Control UI again ## Impact Restores Control UI access for HTTP-only deployments behind reverse proxies.
diff --git a/src/gateway/server/ws-connection/connect-policy.test.ts b/src/gateway/server/ws-connection/connect-policy.test.ts
@@ -182,8 +182,9 @@ describe("ws connect policy", () => {
       controlUiConfig: undefined,
       deviceRaw: null,
     });
+    // When dangerouslyDisableDeviceAuth is true, always skip pairing
     expect(shouldSkipControlUiPairing(bypass, true, false)).toBe(true);
-    expect(shouldSkipControlUiPairing(bypass, false, false)).toBe(false);
+    expect(shouldSkipControlUiPairing(bypass, false, false)).toBe(true); // CHANGED: now skips even without sharedAuth
     expect(shouldSkipControlUiPairing(strict, true, false)).toBe(false);
     expect(shouldSkipControlUiPairing(strict, false, true)).toBe(true);
   });
diff --git a/src/gateway/server/ws-connection/connect-policy.ts b/src/gateway/server/ws-connection/connect-policy.ts
@@ -37,6 +37,11 @@ export function shouldSkipControlUiPairing(
   sharedAuthOk: boolean,
   trustedProxyAuthOk = false,
 ): boolean {
+  // When dangerouslyDisableDeviceAuth is true, skip pairing entirely
+  // This is the intended behavior for HTTP-only deployments
+  if (policy.dangerouslyDisableDeviceAuth) {
+    return true;
+  }
   if (trustedProxyAuthOk) {
     return true;
   }
